From 410ae2701aafab0f6df307c8daf1230fa0b65572 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 24 Oct 2023 13:06:13 -0700 Subject: [PATCH] Remove 2.8 specific content and fix typo --- docs/pages-for-subheaders/rancher-security.md | 4 ---- .../rancher-security/rancher-security-best-practices.md | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/pages-for-subheaders/rancher-security.md b/docs/pages-for-subheaders/rancher-security.md index be85465a18c..b5733b69cc8 100644 --- a/docs/pages-for-subheaders/rancher-security.md +++ b/docs/pages-for-subheaders/rancher-security.md @@ -91,7 +91,3 @@ For recommendations on securing your Kubernetes cluster, refer to the [Kubernete ### Rancher Security Best Practices For recommendations on securing your Rancher Manager deployments, refer to the [Rancher Security Best Practices](../reference-guides/rancher-security/rancher-security-best-practices.md) guide. - -### Rancher Webhook Hardening - -The Rancher webhook deploys on both the upstream (local) Rancher cluster and all provisioned clusters. See the [Hardening the Rancher Webhook](../reference-guides/rancher-security/rancher-webhook-hardening.md) guide for recommendations on protecting your clusters. diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md index 325e2dcbce0..a5151379dce 100644 --- a/docs/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -8,7 +8,7 @@ title: Rancher Security Best Practices ### Restrict Public Access to /version and /rancherversion Path -The upstream (local) Rancher instance provides information about the Rancher version it is running and the Go version that was used to built it. That information is accessible via the `/version` path, which is used for tasks such as automating version bumps, or confirming that a deployment was successful. The upstream instance also provides Rancher version information accessible via the `/rancherversion` path. +The upstream (local) Rancher instance provides information about the Rancher version it is running and the Go version that was used to build it. That information is accessible via the `/version` path, which is used for tasks such as automating version bumps, or confirming that a deployment was successful. The upstream instance also provides Rancher version information accessible via the `/rancherversion` path. Adversaries can misuse this information to identify the running Rancher version and cross-relate it with potential bugs to exploit. If your upstream Rancher instance is publicly available on the web, use a Layer 7 firewall to block `/version` and `/rancherversion`.